Skip to content
Openedx Edx-platform vulnerabilities
-
openedx openedx-platform
Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce
CVE-2026-97702
5.3 Medium
-
openedx openedx-platform
Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
CVE-2026-85271
6.1 Medium
-
openedx openedx-platform
Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
CVE-2026-85272
4.3 Medium
-
openedx openedx-platform
Open edX Platform: SSRF in Studio Video Download Endpoint
CVE-2026-55421
6.8 Medium
-
openedx openedx-platform
Open edX LTI OAuth Replay Attack
CVE-2026-53636
4.7 Medium
-
openedx openedx-platform
Open edX Platform: Insufficient Permission on set_course_mode_price()
CVE-2026-53635
7.6 High
-
openedx, openedx openedx-platform +1 more
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
CVE-2026-42857
4.6 Medium
-
openedx, openedx openedx-platform +1 more
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
CVE-2026-42858
8.5 High
-
openedx, openedx openedx-platform +1 more
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
CVE-2026-35404
4.7 Medium
-
openedx openedx-platform
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
CVE-2026-34736
5.3 Medium
-
openedx edx-platform
CourseLimitedStaff Role Allows Studio Access
CVE-2025-68270
9.9 Critical
-
openedx edx-platform
Learners on edX Platform can download python_lib.zip
CVE-2025-47942
5.3 Medium
-
openedx edx-platform
Open edX Platform's instructor upload CSV for cohort creation not Private by Default
CVE-2024-41806
5.3 Medium
-
edx edx-platform
XBlock custom auth does not respect JWT Scopes
CVE-2024-22209
6.4 Medium